James King wrote:
On Fri, Jan 16, 2009 at 12:15 AM, Jan Engelhardt <jengelh@xxxxxxxxxx> wrote:
Are there perhaps other targets besides MARK whose table restriction
should be relaxed?
I can think of CONNMARK, CLASSIFY, TCPOPTSTRIP for consistency with
TCPMSS and possibly CONNSECMARK (after consulting with James Morris).
connmark is already relaxed, as is connsecmark.
secmark and connsecmark don't specifiy the table in their xt_target
structure, but they do restrict to either the mangle or security table
in their tg_check functions. connmark appears to work in other
tables.
A quick grep shows that the following targets are restricted to the
mangle table in some fashion:
ipt_TTL
ipt_ECN
ip6t_HL (maybe we could merge this together with TTL?)
CLASSIFY
DSCP
SECMARK
CONNSECMARK
MARK
CONNMARK
TPROXY
TCPOPTSTRIP
Also, REJECT is restricted to the filter table, although I'm not sure
it would be useful elsewhere.
We currently only support "restricted to a specific table" or
"not restricted at all". To avoid people misusing it in the
NAT table I'd rather keep that restriction.
Just lifting the mangle restrictions seems OK for now.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
